TRAI ordered Truecaller to hide ‘Spam’ labels on 140 and 1600 numbers. Now, its CEO explains how it backfired

TRAI's Spam Rule Just Handed Enemy Intelligence Services a Gift Wrapped in Red Tape

India's telecom regulator just proved that government cannot secure its own communication channels against spoofing—and did it publicly, on purpose. TRAI ordered Truecaller to whitelist government shortcodes 140 and 1600, removing spam tags that were protecting citizens from impersonators. The stated goal was noble: restore public trust in official helplines. The actual result was catastrophic: destroy public trust completely, and signal to every hostile state actor watching that India's digital defence has a critical blind spot.

What Actually Happened

In 2023, TRAI instructed Truecaller to stop labeling calls from 140 (IVRS government services) and 1600 (national citizen helplines) as spam. The logic was straightforward—these are legitimate government numbers, why would citizens see spam warnings? But Truecaller's CEO went public with a warning that TRAI ignored: removing spam filters from government numbers doesn't increase trust; it creates space for spoofers to impersonate those exact numbers, knowing the spam label won't catch them. Citizens cannot distinguish between real 140 and spoofed 140 anymore. The firewall is gone.

What followed was predictable. Phishing calls claiming to be Income Tax Department, UIDAI, and Ministry of Defence multiplied. Elderly citizens received calls from spoofed government numbers demanding OTPs, bank details, and cryptocurrency transfers. The regulatory move designed to build confidence instead demolished it. Truecaller publicly stated the rule backfired—trust metrics actually fell after implementation.

What This Means for India

This is not a telecom story. This is a national security story wearing a telecom disguise.

India's defence and military infrastructure relies increasingly on digital citizen alert systems. Emergency broadcasts, civil defence warnings, disaster management communications—all channeled through the very shortcodes TRAI just weakened. If a spoofed 140 call can now circulate without spam flagging, then a spoofed military or disaster alert can do the same. Imagine a fake defense ministry broadcast during a border crisis. Imagine a spoofed civil aviation authority alert during a terror threat. In 35 years of manufacturing, I've learned one principle: if the civilian layer is compromised, the military layer follows.

The deeper vulnerability is cryptographic. India's telecom system does not implement end-to-end verification for government communications. There is no digital signature, no blockchain verification, no mutual authentication between caller and receiver. We rely on regulatory whitelisting—a 1990s solution to a 2024 threat. Pakistan, China, and organized crime networks now know exactly where India's telecom defence fails: at the government channel itself.

The Deeper Story Nobody is Telling

TRAI made this decision knowing the risk, because the alternative—admitting that government communication channels cannot be secured—was politically worse. Admitting that would require funding for cryptographic infrastructure, standards committees, international coordination, and public accountability. So instead, they doubled down on whitelisting and hope citizens don't notice the difference between real and fake 140 calls.

This is institutional cargo cult thinking. The regulator mistook regulatory action for actual security. A whitelist is not security; it is opacity. Real security requires verification at the protocol level—something India has not built into its telecom stack. And now, with this order, we've actually made verification impossible because citizens have been told to trust shortcode numbers without verification.

The adversary sees this clearly. Every intelligence service operating against India now knows: use government shortcodes, bypass spam filters, and reach millions of Indian citizens with impersonation attacks at scale. We've weaponized our own communication infrastructure through regulatory incompetence dressed as citizen protection.

What Comes Next

Within 18 months, major phishing campaigns will use spoofed 140 and 1600 numbers targeting military families, defence establishment employees, and critical infrastructure workers. TRAI will respond by re-implementing spam labels, admitting the previous rule failed. But the damage to citizen trust in government communication will persist for years. India will then be forced to build cryptographic verification into its telecom layer—something that should have been done before removing the spam filters, not after.

The lesson for defence planners is harsh: civilian digital infrastructure cannot be treated as secure by mere regulatory assertion. It must be hardened at the architectural level.

Follow BHARAT DECODED on Telegram: t.me/DecodedByRDS — Rajnish Sharma (RDS)